CVE-2026-124575
MEDIUM
MEDIUM
Priority: 0.03
BB Relevance:
73/100
Published: 2026-11-09
Modified: 2026-11-13
First seen: 2026-11-09
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
X
AT:
None
VC:
Low
VI:
None
VA:
None
Description
A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.
Weakness Classification (2)
Affected Software (22)
| Vendor | Product | Version |
|---|---|---|
| SiteServer | SSCMS | 7.0 |
| SiteServer | SSCMS | 7.1 |
| SiteServer | SSCMS | 7.1.0 |
| SiteServer | SSCMS | 7.1.1 |
| SiteServer | SSCMS | 7.1.2 |
| SiteServer | SSCMS | 7.1.3 |
| SiteServer | SSCMS | 7.2 |
| SiteServer | SSCMS | 7.2.0 |
| SiteServer | SSCMS | 7.2.1 |
| SiteServer | SSCMS | 7.3 |
| SiteServer | SSCMS | 7.4.0 |
| SiteServer | SSCMS | 7.0 |
| SiteServer | SSCMS | 7.1 |
| SiteServer | SSCMS | 7.1.0 |
| SiteServer | SSCMS | 7.1.1 |
| SiteServer | SSCMS | 7.1.2 |
| SiteServer | SSCMS | 7.1.3 |
| SiteServer | SSCMS | 7.2 |
| SiteServer | SSCMS | 7.2.0 |
| SiteServer | SSCMS | 7.2.1 |
| SiteServer | SSCMS | 7.3 |
| SiteServer | SSCMS | 7.4.0 |
References & Advisories (7)
vdb-entry
technical-description
third-party-advisory
third-party-advisory
signature
permissions-required
related
patch
issue-tracking
patch